A severe vulnerability (CVE-2024-52281) has been discovered in Rancher, an open-source container management platform widely used for Kubernetes deployments. Rated 8.9 on the CVSS scale, this Stored Cross-Site Scripting (XSS) flaw could allow malicious actors to execute arbitrary JavaScript code, putting production environments at significant risk.
Rancher is a popular container management platform enabling organizations to deploy and manage Kubernetes clusters in production environments. It empowers DevOps teams by simplifying Kubernetes operations and meeting IT compliance requirements.
CVE-2024-52281 stems from a Stored XSS vulnerability in the Rancher UI. The issue lies in the cluster description field, which fails to sanitize user-input HTML code. Malicious actors can exploit this to inject JavaScript, which executes whenever users interact with the affected UI element.
Attackers leveraging this vulnerability could:
- Compromise User Sessions: Steal session cookies or sensitive user information.
- Inject Malicious Scripts: Redirect users to phishing sites or deliver malware.
- Escalate Privileges: Perform actions on behalf of compromised users within Rancher-managed clusters.
Rancher developers have addressed the vulnerability by enhancing HTML sanitization processes. A key change includes replacing the v-tooltip directive with the safer v-clean-tooltip directive, which ensures that all rendered content is sanitized to prevent script injection.
Rancher has addressed this vulnerability in their latest releases, versions 2.9.4 and 2.10.0. Users are strongly urged to update their Rancher deployments immediately to safeguard their systems.
Related Posts:
- Critical Security Flaw in Rancher Exposes vSphere Credentials in Plaintext
- CVE-2024-22036 (CVSS 9.1): Critical RCE Vulnerability Discovered in SUSE Rancher
- Rancher Vulnerability Alert (CVE-2024-22030): Act Now to Prevent Takeovers
- High Severity Flaw in Rancher – Open-Source Container Management Platform
- Critical flaw affects Rancher open source container management platform
